Irisend

Guides

Set up SPF, DKIM and DMARC for a sending domain

SPF, DKIM and DMARC are the three DNS-based checks every major inbox provider uses to decide whether your mail is really from you. This guide shows the exact records Irisend generates for a new domain — not a generic explainer — and how to check your DMARC pass rate after you publish a policy.

  1. 1.Register the domain

    `POST /domains` accepts a `name` and an optional `region` (one of the four Irisend/Resend-shared regions). Irisend generates a fresh 2048-bit DKIM keypair for the domain server-side — you never handle the private key.

    curl -X POST https://api.irisend.com/domains \
  -H "Authorization: Bearer $IRISEND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "yourdomain.com", "region": "eu-west-1" }'

  2. 2.Add the DNS records it returns

    The response's `records` array is the complete set to publish: a DKIM TXT record, an SPF MX + TXT pair on a dedicated sending subdomain (so SPF/DMARC alignment doesn't depend on your root domain's own mail setup), and a DMARC TXT starting at `p=none` so you can monitor before enforcing.

    records (abridged)JSON
    [
  { "record": "DKIM", "type": "TXT", "name": "irisend._domainkey", "value": "p=MIGfMA0GCSq..." },
  { "record": "SPF",  "type": "MX",  "name": "send", "value": "feedback-smtp.eu-west-1.amazonses.com", "priority": 10 },
  { "record": "SPF",  "type": "TXT", "name": "send", "value": "v=spf1 include:amazonses.com ~all" },
  { "record": "DMARC","type": "TXT", "name": "_dmarc", "value": "v=DMARC1; p=none; rua=mailto:d-<domain-id>@dmarc.irisend.com;" }
]

  3. 3.Verify the domain

    Once the records are live, trigger a check. Irisend also checks automatically in the background, so this is the manual "check now" button — useful right after you've just updated DNS and don't want to wait for propagation polling.

    curl -X POST https://api.irisend.com/domains/dom_xxx/verify \
  -H "Authorization: Bearer $IRISEND_API_KEY"

  4. 4.Ramp DMARC from none to reject

    A DMARC policy only protects you once it's enforced (`p=quarantine` or `p=reject`), but jumping straight there risks dropping your own legitimate mail if something's misconfigured. Irisend's DMARC summary endpoint reports your current pass rate and a recommended next policy, computed from the aggregate reports your `rua=` address has actually received.

    curl https://api.irisend.com/domains/dom_xxx/dmarc/summary \
  -H "Authorization: Bearer $IRISEND_API_KEY"

Related

Next

Read the full API reference, the Resend migration guide, or see pricing.